---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR (MedEx Module)
AFFECTED_VERSIONS: Prior to 8.0.0
---END_METADATA---

Description Summary:
An unauthenticated token disclosure in OpenEMR's MedEx callback endpoint leaks API tokens, leading to PHI exfiltration and HIPAA violations.

Executive Summary:
OpenEMR contains a critical vulnerability where an unauthenticated attacker can steal MedEx API tokens, resulting in the exposure of sensitive patient health information.

Vulnerability Details

CVE-ID: CVE-2026-24898

Affected Software: OpenEMR

Affected Versions: Prior to 8.0.0

Vulnerability: The MedEx callback endpoint explicitly bypasses authentication ($ignoreAuth = true). By providing a callback_key via POST, an unauthenticated visitor triggers a login process that returns the full JSON response, including sensitive MedEx API tokens.

Business Impact

This vulnerability carries a CVSS score of 10. The exposure of API tokens allows for complete third-party service compromise, unauthorized actions on the MedEx platform, and the exfiltration of Protected Health Information (PHI). This constitutes a major security failure and a direct violation of HIPAA regulations.

Remediation Plan

Immediate Action: Upgrade OpenEMR to version 8.0.0 immediately. Following the upgrade, revoke and rotate all MedEx API tokens to ensure any previously leaked tokens are invalidated.

Proactive Monitoring: Review access logs for the MedEx callback endpoint for unauthorized POST requests and monitor MedEx platform logs for suspicious activity.

Compensating Controls: Implement IP whitelisting for the MedEx callback endpoint so that only legitimate MedEx servers can communicate with the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. Given the sensitivity of the data involved, this vulnerability is a prime target for attackers seeking medical records.

Analyst Recommendation

This is a critical security flaw with severe legal and financial implications. We strongly urge immediate patching and token rotation to protect patient data and maintain regulatory compliance.

Executive Summary:
A critical vulnerability has been identified in the Erugo self-hosted file-sharing platform, allowing a low-privileged authenticated user to gain full control of the server. An attacker can exploit this flaw by uploading a malicious file to a web-accessible location, leading to remote code execution. This complete system compromise poses a severe risk of data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-24897

Affected Software: Erugo is a Multiple Products

Affected Versions: Versions up to and including 0.2.14

Vulnerability: The vulnerability exists due to insufficient path validation in the file-sharing creation feature. An authenticated attacker with low-level privileges can specify a crafted file path, such as one using path traversal sequences (../), when creating a new share. This allows them to bypass directory restrictions and designate a share location anywhere on the filesystem where the application has write permissions, including the public web root directory. By subsequently uploading a web shell or other executable script to this share, the attacker can place malicious code in a publicly accessible location and execute it by simply visiting the corresponding URL, resulting in full remote code execution on the server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10. Successful exploitation results in a complete compromise of the server hosting the Erugo platform. This could lead to the theft or destruction of all stored data, installation of ransomware, or the use of the compromised server to launch further attacks against the internal network. The potential business impact includes significant data breach costs, regulatory fines, operational downtime, and severe reputational damage. Since the only prerequisite for an attacker is a low-privileged account, the risk of exploitation is high in any environment where user registration is open or multiple users have access.

Remediation Plan

Immediate Action: Immediately upgrade all instances of Erugo to version 0.2.15 or later, which contains the fix for this vulnerability. After patching, review server access logs and application logs for any signs of suspicious activity, such as unusual file creation requests or access to unexpected files in the web root.

Proactive Monitoring: Implement enhanced monitoring of the Erugo application and underlying server. Specifically, monitor application logs for share creation events containing path traversal sequences (../). Use file integrity monitoring (FIM) to alert on any new files, especially those with executable extensions (.php, .sh, .jsp, etc.), being written to the web root directory outside of normal deployment processes.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules to detect and block path traversal attacks.
• Strictly enforce file system permissions to prevent the web server's user account from writing to the web root or other sensitive directories.
• If business functionality allows, temporarily disable file upload capabilities for all non-administrative users.
• Audit all existing user accounts and remove any that are unnecessary or have excessive privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Jan 28, 2026), there are no publicly available exploits or reports of active exploitation in the wild. However, given the critical impact and the relative simplicity of the attack vector, proof-of-concept (PoC) exploits are expected to be developed and published quickly. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the critical severity (CVSS 10.0) and the potential for a low-privileged user to achieve complete system compromise, this vulnerability requires immediate attention. All organizations using affected versions of Erugo must prioritize applying the update to version 0.2.15 or later. The low barrier to exploitation makes this an attractive target for attackers, and organizations should assume it will be actively targeted in the near future.

---METADATA---
VENDOR: Arch (Node.js Library)
PRODUCT: Compressing
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the 'Compressing' Node.js library could allow for arbitrary file manipulation during the compression or decompression process.

Executive Summary:
The 'Compressing' library for Node.js contains a high-severity vulnerability that could allow attackers to perform unauthorized file writes on the host system.

Vulnerability Details

CVE-ID: CVE-2026-24884

Affected Software: Compressing (Node.js library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability likely involves a "Zip Slip" or path traversal flaw within the compression/uncompression functions. An attacker providing a malicious archive could potentially write files to arbitrary locations on the server, often without authentication if the library processes user-uploaded files.

Business Impact

A CVSS score of 8.4 reflects the high risk of Remote Code Execution (RCE) or system takeover. By overwriting critical system files or application code, an attacker can gain persistent access to the server, leading to data theft and significant operational impact.

Remediation Plan

Immediate Action: Developers should update the 'Compressing' dependency in their package.json to the latest secure version and redeploy affected applications.

Proactive Monitoring: Audit application code to ensure that all file paths extracted from archives are validated and sanitized before being written to the disk.

Compensating Controls: Run Node.js applications in a restricted environment (e.g., containers with read-only file systems where possible) to limit the impact of unauthorized file writes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Library vulnerabilities are particularly dangerous as they can affect a wide range of downstream applications.

Analyst Recommendation

We strongly recommend that development teams audit their Node.js projects for the 'Compressing' library and update it immediately. Failure to patch this library could leave servers vulnerable to full system compromise via malicious file uploads.

---METADATA---
VENDOR: themrdemonized
PRODUCT: xray-monolith
AFFECTED_VERSIONS: before 2025.12.30
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A type confusion vulnerability in themrdemonized xray-monolith before version 2025.12.30 could allow an attacker to trigger memory corruption or arbitrary code execution.

Executive Summary:
A critical type confusion vulnerability in the themrdemonized xray-monolith software, present in versions prior to 2025.12.30, poses a significant risk of memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-24874

Affected Software: themrdemonized xray-monolith

Affected Versions: before 2025.12.30

Vulnerability: This is a type confusion vulnerability where the application handles resources using an incompatible type. The specific authentication requirements for exploitation are not explicitly defined, but such flaws typically allow for memory corruption or arbitrary code execution if successfully triggered.

Business Impact

With a CVSS score of 9.1, this vulnerability is classified as critical. Successful exploitation could lead to application crashes, unauthorized information disclosure, or full system compromise, resulting in significant operational downtime and potential data breaches.

Remediation Plan

Immediate Action: Upgrade to version 2025.12.30 or the latest available release to resolve the underlying type confusion flaw.

Proactive Monitoring: Review system and application logs for unusual crashes or error patterns that may indicate attempts to trigger memory corruption.

Compensating Controls: Ensure the application runs with the principle of least privilege to contain the potential impact of a compromised process.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of type confusion vulnerabilities, immediate patching is essential to prevent potential exploitation. Organizations should prioritize upgrading affected instances of xray-monolith immediately.

---METADATA---
VENDOR: ProjectSkyfire
PRODUCT: SkyFire_548
AFFECTED_VERSIONS: before 5.4.8-stable5
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An improper pointer arithmetic vulnerability exists in ProjectSkyfire SkyFire_548 versions prior to 5.4.8-stable5, which may allow for memory corruption or arbitrary code execution.

Executive Summary:
A critical improper pointer arithmetic vulnerability in ProjectSkyfire SkyFire_548, affecting all versions prior to 5.4.8-stable5, introduces a high risk of memory-based exploitation.

Vulnerability Details

CVE-ID: CVE-2026-24872

Affected Software: ProjectSkyfire SkyFire_548

Affected Versions: before 5.4.8-stable5

Vulnerability: The vulnerability stems from improper pointer arithmetic, which can lead to out-of-bounds memory access. This type of flaw is typically exploitable for memory corruption, potentially allowing an attacker to achieve arbitrary code execution.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation could lead to total compromise of the affected application environment, resulting in data loss, service interruption, and unauthorized access to sensitive system resources.

Remediation Plan

Immediate Action: Upgrade to version 5.4.8-stable5 or the latest available version provided by ProjectSkyfire.

Proactive Monitoring: Monitor the application for unexpected restarts or abnormal memory usage patterns which may suggest an exploitation attempt.

Compensating Controls: Utilize memory protection features provided by the operating system, such as Address Space Layout Randomization (ASLR), to increase the difficulty of successful exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Pointer arithmetic vulnerabilities are highly dangerous as they often allow for reliable control over program execution. It is imperative that all instances of SkyFire_548 are updated to version 5.4.8-stable5 as soon as possible to mitigate this critical risk.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiAnalyzer
AFFECTED_VERSIONS: FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiManager 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiNAC-F 7.6.3-7.6.5; FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in various Fortinet products allows attackers to log into devices registered to other accounts if FortiCloud SSO is enabled.

Executive Summary:
Multiple Fortinet products are affected by a critical authentication bypass vulnerability that permits unauthorized account access via FortiCloud SSO.

Vulnerability Details

CVE-ID: CVE-2026-24858

Affected Software: Fortinet FortiAnalyzer (and other listed Fortinet products)

Affected Versions: See "Affected Versions" in metadata for full scope of impacted firmware across FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy, and FortiWeb.

Vulnerability: This is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. It allows an attacker who possesses a legitimate FortiCloud account and a registered device to authenticate to other devices registered to different accounts, provided FortiCloud SSO is enabled.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of unauthorized access to sensitive network management infrastructure. Exploitation could allow attackers to gain control over security appliances, access logs, or modify firewall policies, leading to severe data breaches or complete network compromise.

Remediation Plan

Immediate Action: Update all affected Fortinet devices to the latest patched firmware versions as specified in the official Fortinet security advisory.

Proactive Monitoring: Review access logs for suspicious login patterns originating from unexpected FortiCloud accounts and monitor for unauthorized changes to administrative settings.

Compensating Controls: If patching is delayed, consider disabling FortiCloud SSO authentication as a temporary measure to block the attack vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of January 27, 2026, this vulnerability is listed in the CISA KEV catalog. While there is no public exploit code, the inclusion in the KEV catalog indicates that the vulnerability is being actively exploited in the wild.

Analyst Recommendation

This vulnerability poses a severe threat to organizational security due to the potential for cross-account unauthorized access. Organizations should treat this as a high-priority update and ensure all affected Fortinet infrastructure is updated immediately to mitigate the risk of compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple ChurchCRM products, a widely used open-source church management system. This flaw, tracked as CVE-2026-24854, could allow a remote, unauthenticated attacker to compromise the application, potentially leading to a complete loss of data confidentiality, integrity, and availability. Immediate patching is required to prevent unauthorized access to sensitive member information and financial data.

Vulnerability Details

CVE-ID: CVE-2026-24854

Affected Software: ChurchCRM Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an unauthenticated SQL injection flaw within the application's public-facing API endpoints. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL queries to a vulnerable endpoint. Successful exploitation allows the attacker to bypass authentication, execute arbitrary code on the database server, and potentially gain full administrative control over the underlying server operating system.

Business Impact

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 8.8. Successful exploitation could lead to the complete compromise of the ChurchCRM system. The potential consequences include unauthorized access to and exfiltration of sensitive Personally Identifiable Information (PII) of church members, disclosure of confidential financial and donation records, and reputational damage. An attacker could also deface the application or use the compromised server as a pivot point for further attacks against the internal network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. System administrators should prioritize the deployment of these patches across all affected ChurchCRM instances. Following the update, it is crucial to review web server and application access logs for any signs of exploitation attempts that may have occurred prior to patching.

Proactive Monitoring: Implement enhanced monitoring on the systems running ChurchCRM. Security teams should look for suspicious activity in web server logs, such as unusual URL requests containing SQL keywords (e.g., UNION, SELECT, SLEEP). Monitor for unexpected outbound network connections from the server and any unauthorized changes to files within the web application's directory.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attacks.
• Restrict access to the ChurchCRM application and its administrative interfaces to trusted IP addresses only.
• Ensure the database user account used by the application adheres to the principle of least privilege and cannot execute system-level commands.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of February 1, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, given the high severity and relative ease of exploitation for this type of flaw, it is highly probable that threat actors will develop and begin using exploits in the near future.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the critical nature of the data managed by ChurchCRM, this vulnerability requires immediate attention. Organizations must prioritize applying the vendor-supplied patches to all affected systems without delay. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime candidate for future inclusion and a high-value target for attackers. If patching is delayed, the compensating controls listed above should be implemented as an urgent temporary measure.

---METADATA---
VENDOR: Caido
PRODUCT: Caido
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Caido web security auditing toolkit is affected by a high-severity vulnerability that could compromise the security of the auditing environment.

Executive Summary:
Caido, a professional web auditing toolkit, contains a high-severity vulnerability that could allow for unauthorized access or compromise of sensitive security testing data.

Vulnerability Details

CVE-ID: CVE-2026-24853

Affected Software: Caido

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Caido auditing toolkit. Given Caido's function as a proxy and analysis tool for web traffic, a high-severity flaw (CVSS 8.1) in this software could potentially allow an attacker to intercept or manipulate the security professional's auditing session.

Business Impact

A compromise of a security professional's toolkit is a critical event. An attacker could potentially gain access to the sensitive vulnerabilities, session tokens, and request data captured during a security audit. This not only compromises the integrity of the audit itself but could also lead to the exposure of the client systems being tested, resulting in significant legal and reputational liabilities.

Remediation Plan

Immediate Action: Users should update their Caido installation to the latest version immediately to secure their auditing environment.

Proactive Monitoring: Monitor the local workstation and network for any anomalous traffic that suggests the toolkit is being remotely controlled or data is being exfiltrated.

Compensating Controls: Run security auditing tools within isolated virtual machines or containers to prevent a compromise of the tool from affecting the host operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. Security tools are frequently targeted by sophisticated actors to gain insight into what vulnerabilities are being discovered by defenders.

Analyst Recommendation

Security practitioners must ensure their own tools are secure before testing others. We recommend that all Caido users apply the latest updates immediately. Because this tool handles highly sensitive data, the CVSS score of 8.1 reflects a substantial risk to the confidentiality of audit findings.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Versions prior to 7.0.4
---END_METADATA---

Description Summary:
An arbitrary file read vulnerability in OpenEMR allows any authenticated user to access sensitive files on the server filesystem via the EtherFax component.

Executive Summary:
Any authenticated user in OpenEMR can read sensitive server files, potentially exposing credentials, configuration data, and patient information.

Vulnerability Details

CVE-ID: CVE-2026-24849

Affected Software: OpenEMR

Affected Versions: Versions prior to 7.0.4

Vulnerability: The disposeDocument() method in EtherFaxActions.php fails to properly validate file paths. This allows any authenticated user, regardless of their privilege level, to perform path traversal and read arbitrary files from the server.

Business Impact

The exposure of sensitive files can lead to a total breach of patient confidentiality (HIPAA violation) and provide attackers with the credentials needed for further lateral movement or full system compromise. The CVSS score of 9.9 reflects the high impact on data integrity and confidentiality.

Remediation Plan

Immediate Action: Update OpenEMR to version 7.0.4 immediately to patch the insecure file handling logic in the EtherFax component.

Proactive Monitoring: Audit application logs for unusual calls to EtherFaxActions.php and check for attempts to access system files like /etc/passwd or configuration files.

Compensating Controls: Restrict filesystem permissions for the web server user to ensure it cannot access sensitive system directories outside of the application root.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, active exploitation has not been reported. However, because any low-privileged user can exploit this, the internal threat risk is significantly elevated.

Analyst Recommendation

Healthcare organizations must prioritize this update due to the sensitive nature of the data handled by OpenEMR. Applying the patch to version 7.0.4 is the only effective way to prevent unauthorized file access by authenticated users.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability has been identified in the Melange apk package builder's declarative pipeline system.

Executive Summary:
Melange is affected by a high-severity vulnerability that poses a risk to the security and integrity of package build pipelines.

Vulnerability Details

CVE-ID: CVE-2026-24844

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to other recent flaws in the product, this vulnerability involves the processing of declarative pipelines. An attacker could exploit this flaw to perform unauthorized actions within the build environment, potentially impacting the final apk output.

Business Impact

With a CVSS score of 7.9, this vulnerability represents a significant threat to the software supply chain. An attacker could potentially introduce malicious code or backdoors into packages, leading to a loss of trust and potential compromise of downstream users.

Remediation Plan

Immediate Action: Apply the latest security updates to the Melange toolset immediately to protect build pipelines.

Proactive Monitoring: Implement integrity checks for all generated apk packages and monitor build environments for unauthorized process execution.

Compensating Controls: Restrict access to pipeline configuration files and utilize signed commits for all changes to the build infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the repeated identification of flaws in pipeline processing highlights a critical area of risk for Melange users.

Analyst Recommendation

The urgency for remediation is high due to the potential for supply chain contamination. Organizations should update Melange immediately and review their build security posture to ensure defense-in-depth.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw in Melange, a tool for building apk packages using declarative pipelines, could allow for unauthorized actions during the build process.

Executive Summary:
The Melange package builder is vulnerable to a high-severity flaw that could allow attackers to compromise the integrity of the apk package build pipeline.

Vulnerability Details

CVE-ID: CVE-2026-24843

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the declarative pipeline processing in Melange. An attacker with the ability to influence pipeline definitions could potentially execute unauthorized commands or manipulate the resulting apk packages during the build phase.

Business Impact

A compromise of the build pipeline is a critical supply chain risk. With a CVSS score of 8.2, this vulnerability could allow for the injection of malicious code into software packages before they are distributed, leading to widespread downstream compromise of users and systems.

Remediation Plan

Immediate Action: Update Melange to the latest version to ensure that pipeline processing logic is properly secured against exploitation.

Proactive Monitoring: Audit build logs for any anomalous activities or unauthorized changes to the declarative pipeline configurations.

Compensating Controls: Implement strict code review processes for all pipeline definitions and ensure the build environment is isolated from sensitive internal networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Supply chain tools like Melange are increasingly targeted by sophisticated actors to facilitate large-scale attacks.

Analyst Recommendation

Security teams should prioritize updating their build infrastructure. Ensuring the integrity of the software supply chain is paramount, and applying this patch is a critical step in preventing malicious package injection.

Executive Summary:
A critical command injection vulnerability has been identified in the Dokploy PaaS, affecting versions prior to 0.26.6. This flaw allows an authenticated attacker to execute arbitrary commands on the underlying server, potentially leading to a complete system compromise, data theft, and service disruption. Due to the high severity (CVSS 9.9), immediate patching is required to prevent a full takeover of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-24841

Affected Software: Dokploy is a Multiple Products

Affected Versions: All versions prior to 0.26.6

Vulnerability: The vulnerability is a command injection flaw within the /docker-container-terminal WebSocket endpoint. The endpoint accepts containerId and activeWay parameters which are insecurely passed to a shell command on the host server without proper sanitization or validation. An authenticated attacker can manipulate these parameters to inject and execute arbitrary shell commands with the privileges of the Dokploy service, leading to remote code execution (RCE) on the host.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9. Successful exploitation would result in a complete compromise of the server hosting Dokploy, granting the attacker full control. The potential business impact includes theft or modification of sensitive data, deployment of ransomware, complete disruption of all applications managed by Dokploy, and the ability for an attacker to use the compromised server as a pivot point to attack other systems within the internal network. This represents a total loss of confidentiality, integrity, and availability for the affected system and its hosted services.

Remediation Plan

Immediate Action: Immediately upgrade all Dokploy instances to version 0.26.6 or later, which contains the fix for this vulnerability. After patching, review system and application logs for any signs of compromise or suspicious activity preceding the update.

Proactive Monitoring:

• Monitor WebSocket connection logs for unusual or malformed requests to the /docker-container-terminal endpoint.
• Implement host-based monitoring to detect anomalous process execution, especially unexpected shell commands spawned by the Dokploy user/service.
• Analyze outbound network traffic from the Dokploy server for connections to unknown or malicious destinations.
• Review Dokploy access logs for unauthorized or suspicious authentication events.

Compensating Controls: If patching cannot be performed immediately, implement the following controls:

• Restrict network access to the Dokploy management interface and API endpoints to trusted IP addresses using a firewall.
• Deploy a Web Application Firewall (WAF) with rules specifically designed to inspect and block malicious WebSocket payloads targeting command injection.
• Enforce the principle of least privilege for all user accounts with access to Dokploy, and ensure multi-factor authentication is enabled.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jan 28, 2026, there are no widespread reports of active exploitation in the wild. However, command injection vulnerabilities of this nature are trivial to exploit once discovered. It is highly probable that functional proof-of-concept (PoC) exploit code will become publicly available shortly, significantly increasing the risk. The only mitigating factor is the requirement for the attacker to be authenticated.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the risk of complete system compromise, it is imperative that organizations treat this vulnerability with the highest priority. The provided remediation to upgrade to version 0.26.6 or later should be applied immediately across all affected systems. Although this vulnerability is not currently listed on the CISA KEV list, its severity makes it a prime candidate for future inclusion. Do not delay patching.

Executive Summary:
A critical vulnerability exists in multiple DNN products that allows an attacker to inject malicious scripts into module titles. When a user views a page with a compromised module, this script can execute in their browser, potentially leading to account takeover, data theft, or website defacement. Organizations are urged to apply the available security updates immediately to mitigate this high-risk threat.

Vulnerability Details

CVE-ID: CVE-2026-24838

Affected Software: DNN Multiple Products

Affected Versions: All versions prior to 9.13.10 and 10.2.0

Vulnerability: The vulnerability is a stored Cross-Site Scripting (XSS) flaw within the module title field. Because this field improperly sanitizes rich text input, an authenticated attacker with permissions to edit module titles can inject malicious HTML and JavaScript code. When any user, including administrators, views the page containing the malicious module title, the injected script executes within the context of their browser session, compromising that session.

Business Impact

With a critical severity rating and a CVSS score of 9.1, this vulnerability poses a significant threat to the organization. Successful exploitation could lead to the theft of sensitive user data, session cookies, and administrative credentials, enabling complete account and site takeover. Further consequences include website defacement, redirection of users to malicious phishing sites, and the deployment of malware, resulting in severe reputational damage, loss of customer trust, and potential regulatory non-compliance.

Remediation Plan

Immediate Action: The primary remediation is to upgrade affected systems. Administrators must update their DNN instances to version 9.13.10, 10.2.0, or a later patched version immediately. Refer to the official DNN security advisory for specific patch instructions and details.

Proactive Monitoring: Security teams should actively monitor web application and server logs for attempts to inject script tags (<script>, <iframe>, onerror) into POST requests associated with module title updates. Review existing module titles across the site for any suspicious code. Implement alerts for unusual client-side script execution or unexpected outbound network traffic from user browsers interacting with the site.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads.
• Restrict permissions for editing module titles to a minimal number of highly trusted administrators.
• Implement a strong Content Security Policy (CSP) to prevent the execution of untrusted inline scripts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jan 28, 2026, there is no known public exploit code or active exploitation of this vulnerability in the wild. However, XSS vulnerabilities in widely used platforms like DNN are often targeted by threat actors shortly after disclosure. The simplicity of exploiting this type of flaw increases the likelihood that proof-of-concept exploits will be developed and published by security researchers.

Analyst Recommendation

Given the critical CVSS score of 9.1, this vulnerability requires immediate attention. We strongly recommend that all organizations using affected DNN products prioritize the deployment of the security patches to versions 9.13.10 or 10.2.0. Although this CVE is not currently on the CISA KEV list, its high severity and potential for complete system compromise present an unacceptable risk. If patching is delayed, the compensating controls outlined above should be implemented as an urgent temporary measure.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (DotNetNuke) web content management system, which operates within the Microsoft ecosystem. This flaw allows a remote, authenticated attacker with low-level privileges to read sensitive files from the underlying server. Successful exploitation could lead to the exposure of confidential data, including configuration details and credentials, potentially enabling further unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-24837

Affected Software: DNN (DotNetNuke)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a path traversal flaw within a component of the DNN platform responsible for file management. The application fails to properly sanitize user-supplied input that specifies a file path. An authenticated attacker can exploit this by crafting a malicious request containing "dot-dot-slash" (../) sequences to navigate outside of the intended web root directory, allowing them to read arbitrary files on the server's file system to which the web server process has access.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. The primary business impact is a breach of confidentiality. Exploitation could allow an attacker to exfiltrate sensitive information, such as the web.config file containing database connection strings and other application secrets, source code, or internal documents stored on the server. This exposure could lead to a full compromise of the application and its data, regulatory penalties for data breaches, and significant reputational damage.

Remediation Plan

Immediate Action: Apply the security updates released by the vendor immediately to all affected DNN instances. Following the update, security teams should monitor for any potential exploitation attempts that may have occurred prior to patching by carefully reviewing web server access logs for suspicious requests.

Proactive Monitoring: Monitor web server logs (e.g., IIS logs) for GET or POST requests containing path traversal sequences like ../, ..\\, or their URL-encoded equivalents (%2e%2e%2f). Implement alerts for any attempts to access critical system files (e.g., web.config, boot.ini, /etc/passwd) via the web application. Utilize a Web Application Firewall (WAF) to detect and block malicious requests matching path traversal signatures.

Compensating Controls: If patching cannot be performed immediately, implement a WAF with strict rules to block path traversal patterns. Additionally, enforce the principle of least privilege by ensuring the web server's service account has the minimum necessary file system permissions, restricting its access to directories outside of the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there are no known public proof-of-concept exploits or active attacks leveraging this vulnerability. However, given the low complexity of path traversal attacks, it is highly likely that exploit code will be developed and released publicly in the near future. Threat actors are expected to begin scanning for vulnerable systems shortly.

Analyst Recommendation

Given the high severity score (CVSS 7.6) and the low complexity required for exploitation, this vulnerability poses a significant risk to the organization. We strongly recommend prioritizing the immediate patching of all internet-facing DNN applications. Although this CVE is not currently listed on the CISA KEV catalog, its characteristics make it an attractive target for attackers. Where immediate patching is not feasible, the compensating controls outlined above should be implemented as a matter of urgency to mitigate the risk of a data breach.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (DotNetNuke) web content management system, a platform that operates within the Microsoft ecosystem. This flaw could allow a remote attacker to gain elevated privileges on a targeted website, potentially leading to a full system compromise. Successful exploitation could result in unauthorized data access, website defacement, or the execution of arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-24836

Affected Software: DNN (DotNetNuke)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a privilege escalation flaw within a core component of the DNN platform. An authenticated attacker with low-level user permissions can exploit an improper input validation weakness in a specific API endpoint. By sending a specially crafted request to this endpoint, the attacker can bypass security checks and grant their own account administrative-level privileges, effectively taking full control of the CMS.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. Exploitation could have a significant negative impact on the business. Potential consequences include the theft or exposure of sensitive company or customer data stored within the website's database, reputational damage resulting from website defacement or compromise, and operational disruption if the website is rendered inaccessible. A compromised web server could also be used as a foothold to launch further attacks against the organization's internal network.

Remediation Plan

Immediate Action: Apply the security updates released by the vendor immediately to patch the vulnerability. After patching, it is critical to review web server and application access logs for any evidence of suspicious activity or unauthorized privilege escalation that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on DNN application logs, specifically looking for unusual or malformed requests to API endpoints, unexpected changes in user role permissions, and unauthorized modifications to site content or configuration files. Monitor for newly created administrative accounts or any activity from low-privilege accounts that mimics administrative actions.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rulesets designed to block common privilege escalation attack patterns.
• Restrict access to the DNN administrative login page to trusted IP addresses only.
• Enforce Multi-Factor Authentication (MFA) on all accounts, especially those with administrative privileges.
• Conduct a thorough review of all user accounts and remove or downgrade any that are unnecessary or have excessive permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, vulnerabilities in widely-used CMS platforms are attractive targets for threat actors, and it is likely that exploits will be developed and utilized in the near future.

Analyst Recommendation

Given the high severity of this vulnerability (CVSS 7.6) and its potential for complete system compromise, organizations are strongly urged to prioritize the application of vendor-supplied patches across all affected DNN instances. Although this CVE is not currently listed on the CISA KEV catalog, its impact makes it a significant risk. In addition to patching, organizations should implement the recommended monitoring and compensating controls to build a defense-in-depth security posture and protect against potential exploitation.

---METADATA---
VENDOR: Kata Containers
PRODUCT: Kata Containers
AFFECTED_VERSIONS: prior to 3.27.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Kata Containers allows a container user to modify the guest VM file system, resulting in arbitrary code execution as root within the micro VM.

Executive Summary:
A critical vulnerability in Kata Containers allows local guest users to achieve arbitrary code execution as root by modifying the guest micro VM file system.

Vulnerability Details

CVE-ID: CVE-2026-24834

Affected Software: Kata Containers

Affected Versions: Prior to 3.27.0

Vulnerability: This is a privilege escalation and code execution vulnerability occurring within the Cloud Hypervisor implementation. A local attacker with access to a container can manipulate the guest micro VM file system to execute arbitrary commands with root privileges.

Business Impact

The ability for a container user to escalate privileges to root within a Guest VM represents a critical security failure, justifying the 9.3 CVSS score. While the impact is largely contained to the specific micro VM, it undermines the isolation guarantees of the containerized environment, potentially leading to unauthorized data access and persistent local compromise.

Remediation Plan

Immediate Action: Upgrade all Kata Containers deployments to version 3.27.0 or later immediately to patch the hypervisor integration.

Proactive Monitoring: Review guest VM runtime logs for unexpected file system modifications or anomalous process execution by non-privileged accounts.

Compensating Controls: Ensure strict container resource limits and, where applicable, avoid running untrusted code within multi-tenant Kata environments until patching is complete.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant breach of container isolation boundaries. Given the potential for root-level code execution within the guest environment, organizations should prioritize updating to version 3.27.0 in all production clusters to restore security parity.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (formerly DotNetNuke) web content management system, which operates within the Microsoft ecosystem. Successful exploitation could allow a remote attacker to execute arbitrary code on the server, potentially leading to a complete system compromise, data theft, or website defacement. Organizations utilizing the affected software are at significant risk and should take immediate action to mitigate this threat.

Vulnerability Details

CVE-ID: CVE-2026-24833

Affected Software: DNN (DotNetNuke) Platform

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is an insecure deserialization flaw within a core component of the DNN platform. An unauthenticated remote attacker can exploit this by sending a specially crafted serialized object to a publicly accessible application endpoint. The application fails to properly validate this input before deserializing it, allowing the attacker's malicious object to be processed, which results in arbitrary code execution in the security context of the web server's application pool identity.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. A successful exploit could have a severe impact on the business, leading to a full compromise of the web server hosting the DNN application. Potential consequences include the theft or exposure of sensitive data stored in the website's database (such as customer information, user credentials, or proprietary content), reputational damage from website defacement, and financial loss due to system downtime. Furthermore, a compromised server could be used as a staging point for attackers to pivot into the broader corporate network, escalating the incident significantly.

Remediation Plan

Immediate Action: The primary and most effective remediation is to apply the security updates provided by the vendor to all affected DNN instances immediately. After patching, it is crucial to review web server and application logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring:

• Log Analysis: Scrutinize web server access logs (e.g., IIS logs) for unusual or malformed POST requests, particularly those with large or strangely encoded payloads which may indicate serialized objects. Monitor application and system event logs for unexpected process execution originating from the web server process (e.g., w3wp.exe spawning cmd.exe or powershell.exe).
• Network Traffic: Monitor for anomalous outbound connections from the web server to unknown or suspicious IP addresses, as this could be a sign of a reverse shell or data exfiltration.
• File Integrity: Implement file integrity monitoring on the web application's directory to detect unauthorized file modifications or additions.

Compensating Controls: If immediate patching is not feasible, the following controls can help reduce risk:

• Deploy a Web Application Firewall (WAF) and create virtual patching rules to inspect and block requests containing known insecure deserialization patterns.
• Restrict administrative access to the DNN portal to a limited set of trusted IP addresses.
• Ensure the web application is running under a least-privilege service account to limit the impact of a potential code execution event.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there are no known public proof-of-concept exploits or active attacks targeting this vulnerability. However, given the severity and potential for remote code execution, it is highly probable that threat actors will reverse-engineer the patch and develop functional exploits in the near future.

Analyst Recommendation

This is a high-impact vulnerability that could allow for a full compromise of public-facing web servers. Due to the high CVSS score and the critical nature of the flaw, immediate patching should be considered the top priority. While this vulnerability is not currently listed on the CISA KEV catalog, its severity makes it a strong candidate for future inclusion. Organizations are strongly advised to apply the vendor-supplied security updates to all affected DNN instances without delay and implement the recommended monitoring controls to detect any potential exploitation attempts.

---METADATA---
VENDOR: ixray-team
PRODUCT: ixray-stcop
AFFECTED_VERSIONS: before 1.3
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability exists in the ixray-stcop software, potentially allowing for arbitrary code execution or system instability.

Executive Summary:
An out-of-bounds write vulnerability in ixray-stcop poses a critical risk of system compromise and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-24832

Affected Software: ixray-team ixray-stcop

Affected Versions: before 1.3

Vulnerability: This is an out-of-bounds write vulnerability occurring within the software, which can be leveraged by an attacker to overwrite memory, potentially leading to arbitrary code execution. The authentication requirement is currently unspecified, but such memory corruption flaws often allow for unauthenticated exploitation.

Business Impact

The CVSS score of 9.8 indicates a critical severity level, as memory corruption vulnerabilities often result in a complete loss of confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain full control over the host system, leading to unauthorized data access and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to version 1.3 or higher immediately to address the out-of-bounds write flaw.

Proactive Monitoring: Review system logs for signs of anomalous crashes or unexpected process behavior that may indicate exploitation attempts.

Compensating Controls: Implement memory protection mechanisms at the OS level, such as Address Space Layout Randomization (ASLR), to increase the difficulty of successful exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score, this vulnerability represents a significant risk to organizational infrastructure. Administrators are urged to prioritize updating the affected software to the patched version as soon as possible to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Ralim
PRODUCT: IronOS
AFFECTED_VERSIONS: before v2.23-rc2
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An integer overflow or wraparound vulnerability in Ralim IronOS could allow attackers to trigger memory corruption or logic errors.

Executive Summary:
An integer overflow vulnerability in Ralim IronOS presents a critical risk of system instability or unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-24830

Affected Software: Ralim IronOS

Affected Versions: before v2.23-rc2

Vulnerability: The vulnerability consists of an integer overflow or wraparound flaw within the IronOS firmware. This can potentially be exploited to bypass security checks or cause memory corruption, likely requiring local or physical access depending on the specific device implementation.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. An exploit could lead to complete system compromise, potentially rendering the affected hardware unusable or allowing an attacker to execute arbitrary commands, which poses a severe threat to operational continuity and data security.

Remediation Plan

Immediate Action: Update IronOS to version v2.23-rc2 or later to resolve the integer overflow vulnerability.

Proactive Monitoring: Monitor for unexpected device reboots or erratic behavior that might indicate successful exploitation of an overflow condition.

Compensating Controls: Restrict physical or network access to the device management interfaces to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this integer-based flaw necessitates immediate attention. Organizations utilizing IronOS should verify their current firmware version and apply the recommended update to ensure robust protection against potential exploitation.

---METADATA---
VENDOR: OpenHarmony
PRODUCT: OpenHarmony
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in OpenHarmony v6 that requires immediate attention from security administrators to evaluate impact.

Executive Summary:
A security vulnerability in OpenHarmony v6 poses a significant risk to system integrity and requires prompt assessment and remediation.

Vulnerability Details

CVE-ID: CVE-2026-24792

Affected Software: OpenHarmony

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided data identifies a vulnerability within OpenHarmony v6; however, specific technical details regarding the attack vector or authentication requirements are currently unavailable.

Business Impact

With a CVSS score of 8.1, this vulnerability is classified as High severity. Exploitation could lead to unauthorized system access or compromise of data integrity, potentially resulting in significant operational disruption and loss of confidentiality for systems running the affected platform.

Remediation Plan

Immediate Action: Consult the official OpenHarmony security advisory to identify the specific patch or security update required to remediate this vulnerability.

Proactive Monitoring: Review system access logs for anomalous activity and monitor vendor security bulletins for further technical disclosures.

Compensating Controls: Implement strict network segmentation and apply the principle of least privilege to minimize the potential blast radius of a successful compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity score, organizations utilizing OpenHarmony must prioritize verifying their current version status against vendor documentation. Apply all available security updates as soon as they are released to mitigate potential exposure.

---METADATA---
VENDOR: Unknown
PRODUCT: PLC Device
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The underlying Programmable Logic Controller (PLC) of the device can be remotely influenced due to a lack of proper safeguards or authentication mechanisms.

Executive Summary:
A critical lack of authentication in the PLC component allows remote attackers to manipulate industrial control processes, posing a severe risk to physical operations.

Vulnerability Details

CVE-ID: CVE-2026-24790

Affected Software: PLC Device

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a lack of authentication and safeguards on the remote management interface of a PLC. An unauthenticated attacker can send remote commands to influence the controller's logic and operation.

Business Impact

Insecure PLC interfaces can lead to the disruption of critical infrastructure, damage to physical equipment, and potential safety hazards for personnel. The CVSS score of 8.2 highlights the significant operational risk and the high potential for impact on availability and integrity in industrial environments.

Remediation Plan

Immediate Action: Isolate the PLC from all external networks and ensure it is only accessible via a secure, authenticated management workstation.

Proactive Monitoring: Review PLC diagnostic logs and network traffic for unauthorized protocol commands or unexpected changes in logic states.

Compensating Controls: Implement industrial firewalls and deep packet inspection (DPI) to block unauthorized control traffic at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. Vulnerabilities in industrial control systems (ICS) are highly sought after by sophisticated threat actors for sabotage purposes.

Analyst Recommendation

Protecting industrial assets requires strict network segmentation. We strongly recommend that organizations audit their ICS environment to ensure no PLCs are exposed to the internet and that all control traffic is strictly authenticated and monitored.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unprotected API endpoint in the affected software allows unauthenticated remote attackers to change the device password, leading to complete unauthorized administrative control.

Executive Summary:
A critical API flaw allows unauthenticated attackers to remotely reset device passwords, granting them full control over the affected hardware.

Vulnerability Details

CVE-ID: CVE-2026-24789

Affected Software: Multiple Products (refer to vendor advisory for specific hardware/software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device exposes an unprotected API endpoint that does not require authentication for password modification. This allows a remote, unauthenticated attacker to submit a password change request and lock out legitimate administrators.

Business Impact

This vulnerability poses a severe risk of total device lockout and unauthorized takeover. By changing the administrative password, an attacker can gain full access to the device's settings and data. The CVSS score of 9.8 reflects the high impact on availability and integrity, as the attack is trivial to perform.

Remediation Plan

Immediate Action: Apply the vendor-provided patch immediately to secure the API endpoint and enforce authentication for all administrative actions.

Proactive Monitoring: Monitor API logs for password change requests originating from unexpected or external IP addresses.

Compensating Controls: Disable access to the management API from the public internet and place the affected devices behind a secure gateway or VPN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 11, 2026, there is no public information indicating active exploitation. The simplicity of this flaw makes it a highly attractive target for automated scanning and mass exploitation.

Analyst Recommendation

The ability to change administrative credentials without authentication is a fundamental security failure. Immediate patching is the only effective solution. Organizations should also perform a credential audit to ensure that passwords have not already been modified by unauthorized parties.

Executive Summary:
A high-severity vulnerability has been identified in RaspAP webgui versions prior to 3. This flaw could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device, leading to a full system compromise. Successful exploitation could result in data theft, network disruption, or the use of the compromised device to launch further attacks against the internal network.

Vulnerability Details

CVE-ID: CVE-2026-24788

Affected Software: RaspAP raspap-webgui

Affected Versions: All versions prior to 3.0

Vulnerability: The vulnerability is a command injection flaw within the web-based management interface of RaspAP. An unauthenticated attacker can send a specially crafted HTTP request to a specific API endpoint that fails to properly sanitize user-supplied input. This input is then passed directly to a system shell command, allowing the attacker to inject and execute arbitrary commands on the underlying operating system with the privileges of the web server user.

Business Impact

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 8.8. An attacker successfully exploiting this flaw could gain complete control over the RaspAP device. This could lead to severe consequences, including the interception and theft of sensitive network traffic, unauthorized access to internal network segments, deployment of malware, and disruption of network services. A compromised RaspAP device could serve as a persistent foothold for an attacker to pivot and escalate their attack across the corporate network.

Remediation Plan

Immediate Action: Immediately identify all instances of RaspAP raspap-webgui within the environment and upgrade them to version 3.0 or later, as recommended by the vendor. After patching, review web server and system access logs for any signs of compromise or unusual activity preceding the update.

Proactive Monitoring: Monitor web server logs for suspicious requests containing shell metacharacters (e.g., ;, |, &, $(, `) directed at the RaspAP interface. System-level monitoring should be configured to alert on unexpected processes being spawned by the web server user (e.g., www-data). Network monitoring should focus on identifying anomalous outbound traffic from RaspAP devices.

Compensating Controls: If immediate patching is not feasible, restrict network access to the RaspAP management interface to a dedicated, trusted administrative network or specific IP addresses. If the interface must be exposed, place it behind a Web Application Firewall (WAF) with rulesets configured to detect and block command injection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 2, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity score (8.8) and the nature of the flaw (unauthenticated RCE), it is highly probable that security researchers and threat actors will develop a functional exploit in the near future.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for complete system compromise, we strongly recommend that organizations prioritize the immediate patching of all affected RaspAP devices. Although this CVE is not currently listed on the CISA KEV catalog, its high-impact nature makes it a prime target for future exploitation. All internet-facing instances should be considered critically at risk and addressed immediately, followed by internal instances to prevent lateral movement by an attacker.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
A sandbox breakout vulnerability in the vm2 library's inspect function allows attackers to escape the sandbox and execute arbitrary commands on the host.

Executive Summary:
A critical sandbox breakout vulnerability in the vm2 library's inspect function allows attackers to escape the sandbox and execute arbitrary commands on the host.

Vulnerability Details

CVE-ID: CVE-2026-24781

Affected Software: vm2 (Node.js)

Affected Versions: Prior to 3.11.0

Vulnerability: The inspect function in vm2 allows an attacker to manipulate objects in a way that escapes the sandbox environment. This facilitates arbitrary code execution on the host system running the Node.js environment.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat. Successful exploitation grants the attacker the same permissions as the Node.js process, which can lead to data exfiltration, system destruction, or unauthorized lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 dependency to version 3.11.0 or later to mitigate this sandbox breakout vector.

Proactive Monitoring: Monitor for anomalous usage of the inspect function or unexpected object manipulation patterns within the application.

Compensating Controls: Implement robust ingress and egress filtering on the host system to prevent unauthorized command-and-control communication in the event of an escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The frequency of sandbox escape vulnerabilities in vm2 suggests that it is not a secure solution for running untrusted code. Organizations are strongly advised to update the library and investigate safer alternatives for code isolation if the requirement for running untrusted code persists.

---METADATA---
VENDOR: GUnet
PRODUCT: Open eClass
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Open eClass course management platform is affected by a high-severity vulnerability that could lead to unauthorized platform access or data compromise.

Executive Summary:
The Open eClass platform contains a security flaw that poses a high risk to the confidentiality and integrity of educational data and user accounts.

Vulnerability Details

CVE-ID: CVE-2026-24773

Affected Software: GUnet Open eClass

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Open eClass course management system. While the specific technical flaw is not detailed, the CVSS score of 7.5 suggests a vulnerability that could be exploited by an unauthenticated or authenticated attacker to perform unauthorized actions or access sensitive course materials.

Business Impact

A successful exploit could result in the exposure of sensitive student data, unauthorized modification of grades, or the theft of academic intellectual property. With a CVSS score of 7.5, the risk to educational institutions is significant, potentially leading to regulatory non-compliance, loss of student trust, and operational disruptions.

Remediation Plan

Immediate Action: Upgrade the Open eClass platform to the latest version provided by GUnet to resolve this security vulnerability.

Proactive Monitoring: Audit user account activities and course enrollment logs for any unauthorized changes or suspicious login attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious traffic and enforce strict access control policies for the eClass administrative interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Educational platforms are common targets for credential harvesting and data theft.

Analyst Recommendation

Institutions using Open eClass should move quickly to apply the available security updates. Protecting the academic environment requires proactive patching to prevent attackers from compromising sensitive educational data and system integrity.

Executive Summary:
A critical "Zip Slip" vulnerability exists in the RAGFlow open-source engine, which could allow an unauthenticated remote attacker to gain full control of the server. By uploading a specially crafted ZIP archive, an attacker can overwrite arbitrary files, leading to remote code execution. This vulnerability poses a severe risk of complete system compromise, data breach, and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-24770

Affected Software: RAGFlow

Affected Versions: Version 0.23.1 and possibly earlier versions.

Vulnerability: The vulnerability is a path traversal flaw, commonly known as "Zip Slip," within the MinerUParser class. The _extract_zip_no_root function responsible for extracting ZIP archives fails to properly sanitize or validate the file paths contained within the archive. An attacker can create a malicious ZIP file containing entries with path traversal sequences (e.g., ../../../../path/to/malicious_file.sh). When the RAGFlow application processes this archive, it will extract the file outside of the intended destination directory, allowing the attacker to overwrite sensitive system files, such as shell configuration files, web server executables, or SSH authorized keys, ultimately leading to remote code execution on the underlying server.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, reflecting the high potential for severe business impact. Successful exploitation grants an attacker complete control over the affected server, enabling them to execute arbitrary commands. This could lead to the theft or destruction of sensitive data, deployment of ransomware, disruption of business-critical services, and use of the compromised system to launch further attacks against the internal network. The potential consequences include significant financial losses, reputational damage, and regulatory penalties related to data breaches.

Remediation Plan

Immediate Action: Immediately upgrade all RAGFlow instances to a patched version that incorporates the fix from commit 64c75d558e4a17a4a48953b4c201526431d8338f or a subsequent official release. After patching, review system logs and file integrity to detect any signs of prior compromise.

Proactive Monitoring:

• Monitor web server and application logs for suspicious ZIP file upload attempts, particularly those that result in errors or unexpected behavior.
• Implement file integrity monitoring (FIM) on critical system directories to alert on unauthorized changes.
• Monitor for unusual process execution, outbound network connections, or newly created user accounts on the RAGFlow server, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Use a Web Application Firewall (WAF) with rules designed to inspect and block file uploads containing path traversal sequences.
• Run the RAGFlow application as a low-privilege user to limit the scope of files that can be overwritten.
• Segment the RAGFlow server from other critical network resources to contain the potential impact of a breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 27, 2026, there is no known public proof-of-concept exploit or active exploitation of this vulnerability. However, the "Zip Slip" attack technique is well-documented, and the public disclosure of the vulnerability and patch provides a clear roadmap for attackers. Therefore, exploit development is considered trivial, and organizations should anticipate that threat actors will attempt to exploit this flaw in the near future.

Analyst Recommendation
Given the critical severity (CVSS 9.8) and the potential for complete system compromise, we strongly recommend that organizations prioritize the immediate patching of this vulnerability. The risk of remote code execution presents a direct threat to the confidentiality, integrity, and availability of the affected system and the data it processes. Although this CVE is not currently listed on the CISA KEV catalog, its critical nature warrants treatment as an urgent and immediate threat.

Executive Summary:
A high-severity vulnerability has been identified in multiple versions of PHPUnit, a widely used testing framework. This flaw could allow a remote attacker to execute arbitrary code on servers where the software is used, such as development, testing, or continuous integration/continuous delivery (CI/CD) environments. Successful exploitation could lead to a complete compromise of the affected system, resulting in data theft, service disruption, or unauthorized access to sensitive corporate networks.

Vulnerability Details

CVE-ID: CVE-2026-24765

Affected Software: PHPUnit Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to the insecure deserialization of untrusted data when processing test stubs or mock objects. An attacker with the ability to influence the data used in a test case—for example, by committing malicious code to a repository or manipulating a data source used by the tests—can craft a serialized PHP object. When the PHPUnit framework processes this object during a test run, it can trigger a "property-oriented programming" (POP) chain, leading to the execution of arbitrary code with the permissions of the user running the tests.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. The primary business impact is the potential compromise of critical development and deployment infrastructure. An attacker could exploit this flaw to steal proprietary source code, inject malicious backdoors into the software supply chain, pivot to other internal systems, or disrupt development operations. A compromise of a CI/CD pipeline represents a significant security event that could damage the company's reputation and the integrity of its products.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor to all affected systems immediately. Prioritize patching on systems integral to the software development lifecycle, such as CI/CD servers (e.g., Jenkins, GitLab Runners) and shared development environments.

Proactive Monitoring: Review application and system logs on test runners for signs of compromise. Look for unusual process execution, unexpected network connections originating from test environments, or logs indicating deserialization errors. Monitor code repositories for suspicious commits that may attempt to introduce a malicious payload.

Compensating Controls: If immediate patching is not feasible, implement compensating controls. Run testing processes in sandboxed or containerized environments with restricted network access to prevent lateral movement. Enforce strict code review policies to detect attempts to introduce malicious serialized payloads into test data.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 28, 2026, proof-of-concept (PoC) exploit code has been publicly released. While there are no confirmed reports of widespread active exploitation in the wild, the availability of a public PoC significantly increases the likelihood of attacks by both sophisticated and unsophisticated threat actors.

Analyst Recommendation

Given the high-severity rating (CVSS 7.8) and the public availability of exploit code, this vulnerability poses a significant and immediate risk to the organization. Although not currently listed on the CISA KEV catalog, its potential impact on software supply chain integrity is critical. We strongly recommend that all teams utilizing PHPUnit prioritize the immediate application of vendor-supplied patches. Systems that cannot be patched should have compensating controls applied without delay while a permanent remediation plan is enacted.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw AI Assistant
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the OpenClaw (formerly Clawdbot) personal AI assistant could allow an attacker to compromise the host device or access private data.

Executive Summary:
The OpenClaw AI assistant contains a high-severity vulnerability that could lead to unauthorized access or full compromise of the user's personal device.

Vulnerability Details

CVE-ID: CVE-2026-24763

Affected Software: OpenClaw OpenClaw AI Assistant

Affected Versions: See vendor advisory for affected versions

Vulnerability: While the specific technical flaw is not detailed in the summary, the vulnerability in the OpenClaw AI assistant likely involves improper handling of user inputs or remote requests. This could allow an attacker to execute code or access the underlying file system of the device running the assistant.

Business Impact

The CVSS score of 8.8 indicates a high severity. Since OpenClaw is designed to run on personal devices with access to private data, a compromise could result in the theft of sensitive personal information, credentials, or the use of the device as a bot in a larger network. This represents a significant privacy and security risk to individual users.

Remediation Plan

Immediate Action: Update the OpenClaw software to the latest available version immediately to apply necessary security patches.

Proactive Monitoring: Monitor device network traffic for unusual outbound connections to unknown IP addresses, which could indicate a compromise.

Compensating Controls: Run the AI assistant in a containerized or sandboxed environment to limit its access to the rest of the host operating system and sensitive files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. AI assistants often have broad permissions, making them attractive targets for exploitation.

Analyst Recommendation

Users of OpenClaw should prioritize updating their installations. Given the high CVSS score, the risk of exploitation is significant. Ensuring the software is updated and running with the minimum necessary permissions is critical for maintaining device security.